Prompt Injection Detection

CloudVera uses a multi-layered approach to detect all 9 prompt injection categories defined by the OWASP LLM Top 10 and Lasso Security standardization framework.

Features

Pattern-Based Detection

Over 200 known injection patterns across 6 categories: instruction override, jailbreak, prompt extraction, delimiter attacks, roleplay exploits, and context manipulation. Catalog updated 2026-06 with grandma-jailbreak, DAN variants (DUDE/STAN/AIM/Maximum), context-reset, reverse-psychology, GCG adversarial suffixes, fictional-authoring framing, safety-test framing, and base64-decode smuggling.

ML-Based Detection

Semantic analysis using embedding models to detect novel injection attempts that don't match known patterns. Catches rephrased attacks with 82%+ cosine similarity.

In-House Multilingual Classifier

CloudVera-trained DistilBERT dual-head classifier scoring every prompt for attack probability. v3 ships F1=1.000 on the E2E harness across English, Spanish, Japanese, Korean, and Hebrew; held-out test set F1=0.887, precision-at-recall-95% of 85.1%. Operator dashboard at /mgt/classifier shows live readiness gauge and per-language hit breakdown.

Cross-Lingual Detection

Detects attack keywords in 8 languages (Russian, Chinese, Arabic, Spanish, French, German, Japanese, Korean), script mixing, and translation-mediated delivery attacks.

Payload Splitting Defense

Reconstructs fragmented payloads from quoted strings, variable concatenation, numbered parts, and character code assembly — then scans the reassembled content for injection.

Cross-Request Correlation

Slow-burn jailbreaks that split payload across multiple conversation turns are tracked per session. 3 violations in 10 minutes triggers a cooldown; 6 hard-blocks the conversation for an hour. Backed by a Durable Object for strongly-consistent counting across concurrent requests.

Behavioral Anomaly Scoring

Per-virtual-key rolling baseline (Welford online mean/variance) of typical risk-score, language, and request-rate distributions. Out-of-distribution requests get an additional risk bump independent of content patterns.

Obfuscation Defense

Scored detection of Base64 encoding, Unicode substitution, homoglyph attacks, zero-width characters, HTML entities, and leetspeak. Smart scoring prevents false positives on benign text.

Severity Scoring

Each detection gets a severity score (0-100). Configure thresholds for block vs. flag actions per project and per detector.